What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Corrupt File, Please Run Chckdsk Utility Warnings (all The Time)

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, I'm from the Philippines. :wavey:

My Hardware Specs:

OS: Windows XP
Pentium 4 1.8GHz
512 MB RAM
128 MB GeForce4 MX 4000

Recently, I began having the "Corrupt File" warning on the system tray pop up every time I start a program. Some programs have even stopped running (Windows Media Player 10 warns about a "Corrupt wmploc.dll" and would not start). Also, the most alarming thing is that my hard drive (which usually has only 1 - 1.5 GB free, Dont ask LOL :P ) recently shows 3GB free, when I haven't deleted or uninstalled any files or programs i the past week.

I suspect I have a malware infection of some kind, so I tried using several removers from Softpedia.com (which are supposed to be guaranteed safe… but i dunno, never had problems with software from there tho :)).

The first software which returned results was RemoveIt by Incode Solutions.

The malware detected were the following:

win32.alcra.f
sys32.bszip
win32.trojan.ibot.a
sys.32.domino

I think RemoveIt has cleaned those, but still no change.

I now have NOD32 antivirus (having removed a previous AVG installation) and have reactivated my Spybot's resident shield (Which, to my undying regret :P, I've deactivated due to the fact that it slows down my already slow PC). Spybot also didn't detect anything, however.

I'm currently officially in DESPAIR, lol :wall:

So asking for help from you guys. Would appreciate it. :)

Here's my HijackThis log


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:56:43 PM, on 8/29/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\runservice.exe
D:\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
D:\Defense Systems\NOD32\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\Mixer.exe
D:\program files\u-storage tool2.9\ustorage.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\VMSnap3.exe
C:\WINDOWS\StartupMonitor.exe
D:\Defense Systems\NOD32\nod32kui.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\WINDOWS\System32\cidaemon.exe
D:\mIRC\mirc.exe
D:\Mozilla Firefox\firefox.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\Defense Systems\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=ytie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O2 - BHO: (no name) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [UStorag] d:\program files\u-storage tool2.9\ustorage.exe sys_auto_run d:\Program Files\U-Storage Tool2.9
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [VMSnap3] C:\WINDOWS\VMSnap3.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [nod32kui] "D:\Defense Systems\NOD32\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: Adobe Gamma Loader.exe.lnk.disabled
O8 - Extra context menu item: Web Rebates. - file://C:\Program Files\WebRebates4\websrebates\webtrebates\toprC0.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROProj.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\WINDOWS\System32\shdocvw.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1187771593874
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1187771555828
O16 - DPF: {CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.4.0_02) -
O16 - DPF: {CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA} (Java Plug-in 1.4.2_11) -
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - D:\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Defense Systems\NOD32\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O24 - Desktop Component 0: (no name) - file:///G:/New%20Folder/she%20is%20wanted%20me%20to%20get%20her%20preggy_______%20-%20The%20World%20of%20Filipinas2_files/cutebaby.gif

–
End of file - 7919 bytes



And here's my StartUp List

StartupList report, 8/29/2007, 7:01:17 PM
StartupList version: 1.52.2
Started from : D:\Defense Systems\Trend Micro\HijackThis\HijackThis.EXE
Detected: Windows XP (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 (6.00.2600.0000)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\runservice.exe
D:\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
D:\Defense Systems\NOD32\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\Mixer.exe
D:\program files\u-storage tool2.9\ustorage.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\VMSnap3.exe
C:\WINDOWS\StartupMonitor.exe
D:\Defense Systems\NOD32\nod32kui.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\WINDOWS\System32\cidaemon.exe
D:\mIRC\mirc.exe
D:\Mozilla Firefox\firefox.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\Defense Systems\Trend Micro\HijackThis\HijackThis.exe

————————————————–

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Adobe Reader Speed Launch.lnk.disabled
Adobe Gamma Loader.exe.lnk.disabled

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
C-Media Mixer = Mixer.exe /startup
UStorag = d:\program files\u-storage tool2.9\ustorage.exe sys_auto_run d:\Program Files\U-Storage Tool2.9
LVCOMSX = C:\WINDOWS\System32\LVCOMSX.EXE
SunJavaUpdateSched = "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
Adobe Reader Speed Launcher = "D:\Adobe\Reader 8.0\Reader\Reader_sl.exe"
VMSnap3 = C:\WINDOWS\VMSnap3.exe
NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
Run StartupMonitor = StartupMonitor.exe
nod32kui = "D:\Defense Systems\NOD32\nod32kui.exe" /WAITSERVICE

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

STYLEXP = C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
swg = C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
YSearchProtection = C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
SpybotSD TeaTimer = C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
=

————————————————–

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=
SCRNSAVE.EXE=C:\WINDOWS\MATRIX~1.SCR
drivers=

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–


Enumerating Browser Helper Objects:

(no name) - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll - {02478D38-C3F9-4efb-9B51-7695ECA05670}
(no name) - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - c:\program files\google\googletoolbar2.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}
(no name) - (no file) - {BDF3E430-B101-42AD-A544-FADC6B084872}
TGTSoft Explorer Toolbar Changer - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll - {C333CF63-767F-4831-94AC-E683D962C63C}
(no name) - (no file) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205}

————————————————–

Enumerating Download Program Files:

[Installation Support]
InProcServer32 = C:\Program Files\Yahoo!\Common\Yinsthelper.dll
CODEBASE = C:\Program Files\Yahoo!\Common\Yinsthelper.dll

[WUWebControl Class]
InProcServer32 = C:\WINDOWS\System32\wuweb.dll
CODEBASE = http://www.update.microsoft.com/microsoftu…b?1187771593874

[MUWebControl Class]
InProcServer32 = C:\WINDOWS\System32\muweb.dll
CODEBASE = http://www.update.microsoft.com/microsoftu…b?1187771555828

[Java Plug-in 1.4.0_02]
InProcServer32 = C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

[Java Plug-in 1.4.2_11]
InProcServer32 = C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

————————————————–

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: *Registry key not found*
WebCheck: %system%\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

————————————————–
End of report, 6,636 bytes
Report generated in 0.140 seconds
Post #2 last edited
ok sorry for the bump… ;)

Its just that I've managed to install Spyware Terminator, a Comodo Firewall, reinstalled my AVG, and installed the AVG anti-rootkit.

I had some success with Spyware Terminator, removing some spyware and trojans which apparently, Spybot hadnt detected :( Here is the Spyware Terminator Log:


Logfile of Spyware Terminator v2.0.0.193 (db:1.0.878.637)
Scan Time: 9/2/2007 1:23:30 AM length: 8846 s
Platform: Windows XP (WINNT 5.1.2600)
User: Admin
Boot Mode: Normal
Scan type: Full_Spyware_Scan
Scanned Objects: 214278 (Critical:84)
Filter: No System items, No Safe items, No Invalid items

Running Processes
StyleXPService.exe : C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
AdskScSrv.exe [Autodesk] : C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
avgamsvr.exe [GRISOFT, s.r.o.] : D:\Grisoft\AVG7\avgamsvr.exe
avgupsvc.exe [GRISOFT, s.r.o.] : D:\Grisoft\AVG7\avgupsvc.exe
BOCORE.exe [COMODO] : D:\Defense Systems\CBOClean\BOCORE.exe
SAgent2.exe [SEIKO EPSON CORPORATION] : C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
runservice.exe : C:\WINDOWS\runservice.exe
raysat_3dsmax8server.exe : D:\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
nvsvc32.exe [NVIDIA Corporation] : C:\WINDOWS\System32\nvsvc32.exe
uphclean.exe [Microsoft Corporation] : C:\Program Files\UPHClean\uphclean.exe
StartupMonitor.exe : C:\WINDOWS\StartupMonitor.exe
avgcc.exe [GRISOFT, s.r.o.] : D:\Grisoft\AVG7\avgcc.exe
BOC425.EXE [COMODO] : D:\Defense Systems\CBOClean\BOC425.EXE
LastFMHelper.exe : D:\Last.fm\LastFMHelper.exe
firefox.exe [Mozilla Corporation] : D:\Mozilla Firefox\firefox.exe
GoogleUpdater.exe [Google] : C:\Program Files\Google\Google Updater\GoogleUpdater.exe
pidgin.exe [The Pidgin developer community] : D:\Pidgin\pidgin.exe
SpywareTerminator.exe [Crawler.com] : D:\Defense Systems\Spyware Terminator\SpywareTerminator.exe

Internet Settings
R - HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar = http://www.google.com/ie
R - HKLM\Software\Microsoft\Internet Explorer\Main, Start Page = http://www.microsoft.com/isapi/redir.dll?p…ER}&ar=home
R - HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant = http://www.google.com/ie
R - HKLM\Software\Microsoft\Internet Explorer\Search, CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
R - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings, ProxyOverride = localhost
R - HKLM\System\CurrentControlSet\Services\Tcpip\Parameters, Domain =
R - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony, DomainName =

BHO
02 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - : C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
02 - BHO: Encarta &Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - [Microsoft Corporation] : C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROProj.dll
02 - BHO: Encarta &Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - [Microsoft Corporation] : C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROProj.dll

StartUps
04 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, swg : [Google Inc.] : C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, Adobe Reader Speed Launcher : [Adobe Systems Incorporated] : D:\ADOBE\READER 8.0\READER\READER_SL.EXE
04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, Run StartupMonitor : : C:\WINDOWS\StartupMonitor.exe
04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, AVG7_CC : [GRISOFT, s.r.o.] : D:\Grisoft\AVG7\avgcc.exe
04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, COMODO Firewall Pro : [COMODO] : C:\FIREWALL\COMODO\FIREWALL\CPF.EXE
04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, BOC-425 : [COMODO] : D:\Defense Systems\CBOClean\BOC425.EXE
04 - Startup: %START_PROGRAMSALL%\Startup\Last.fm Helper.lnk : D:\Last.fm\LastFMHelper.exe

Explorer Bars
Encarta &Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - [Microsoft Corporation] : C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROProj.dll

Shell Extensions
WinZip - {E0D79304-84BE-11CE-9641-444553540000} - [WinZip Computing, Inc.] : C:\Program Files\WinZip\WZSHLSTB.DLL
WinZip - {E0D79305-84BE-11CE-9641-444553540000} - [WinZip Computing, Inc.] : C:\Program Files\WinZip\WZSHLSTB.DLL
WinZip - {E0D79306-84BE-11CE-9641-444553540000} - [WinZip Computing, Inc.] : C:\Program Files\WinZip\WZSHLSTB.DLL
WinZip - {E0D79307-84BE-11CE-9641-444553540000} - [WinZip Computing, Inc.] : C:\Program Files\WinZip\WZSHLSTB.DLL
Desktop Explorer - {1CDB2949-8F65-4355-8456-263E7C208A5D} - [NVIDIA Corporation] : C:\WINDOWS\System32\nvshell.dll
- {1E9B04FB-F9E5-4718-997B-B8DA88302A47} - [NVIDIA Corporation] : C:\WINDOWS\System32\nvshell.dll
eLicense Control - {EB47FF00-225E-11D2-9E1D-00A0C9AB0EEE} - : C:\WINDOWS\lcmmfu.cpl
WinRAR - {B41DB860-8EE4-11D2-9906-E49FADC173CA} - : C:\Program Files\WinRAR\rarext.dll
nView Desktop Context Menu - {1E9B04FB-F9E5-4718-997B-B8DA88302A48} - [NVIDIA Corporation] : C:\WINDOWS\System32\nvshell.dll
TextPad - {2F25CF20-C569-11D1-B94C-00608CB45480} - [Helios Software Solutions] : C:\Program Files\TextPad 4\System\shellext.dll
7-Zip Shell Extension - {23170F69-40C1-278A-1000-000100020000} - [Igor Pavlov] : D:\Dungeons & Dragons\Elvish\7-Zip\7-zip.dll
SpriteExt Class - {C3C4C77D-318A-4E85-ABCB-E7A0B8A96CD9} - [GreenReaper Studios] : C:\WINDOWS\System32\SpriteExtension.dll
ddsExtractor Class - {3B52CC4A-19E9-43F5-A626-F89267A5E43F} - : C:\Program Files\NVIDIA Corporation\DDS Thumbnail Viewer\ddsView.dll
ACDWFTHMBPRXY - {6DEA92E9-8682-4b6a-97DE-354772FE5727} - [Autodesk] : C:\Program Files\Common Files\Autodesk Shared\AcDwfThmbPrxy16.dll
Yahoo! Mail Shell Extension - {5464D816-CF16-4784-B9F3-75C0DB52B499} - [Yahoo! Inc.] : C:\Program Files\Yahoo!\Common\YMMAPI.dll
AVG7 Shell Extension Class - {9F97547E-4609-42C5-AE0C-81C61FFAEBC3} - [GRISOFT, s.r.o.] : D:\Grisoft\AVG7\avgse.dll
AVG7 Find Extension Class - {9F97547E-460A-42C5-AE0C-81C61FFAEBC3} - [GRISOFT, s.r.o.] : D:\Grisoft\AVG7\avgse.dll
ContextMenuExt Extension - {51131DA7-1D24-40e5-AE07-5E3750F5DE3C} - : C:\WINDOWS\ContextMenuExt.dll
SPTHandler - {BD88A479-9623-4897-8546-BC62B9628F44} - [Crawler.com] : D:\Defense Systems\Spyware Terminator\sptcontmenu.dll

Protocol Handler
Microsoft Infotech Storage Protocol for IE 4.0 - {0A9007C0-4076-11D3-8789-0000F8105754} - [Microsoft Corporation] : C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
Protocol Class - {B0D92A71-886B-453B-A649-1B91F93801E7} - [Microsoft Corporation] : C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\msero.dll

Services
23 - : C:\WINDOWS\System32\DRIVERS\ASLM75.SYS
23 - [Autodesk] : C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
23 - [GRISOFT, s.r.o.] : D:\Grisoft\AVG7\avgamsvr.exe
23 - [GRISOFT, s.r.o.] : C:\WINDOWS\System32\Drivers\avg7core.sys
23 - [GRISOFT, s.r.o.] : C:\WINDOWS\System32\Drivers\avg7rsw.sys
23 - [GRISOFT, s.r.o.] : C:\WINDOWS\System32\Drivers\avg7rsxp.sys
23 - [GRISOFT, s.r.o.] : D:\Grisoft\AVG7\avgupsvc.exe
23 - [GRISOFT, s.r.o.] : C:\WINDOWS\System32\Drivers\avgclean.sys
23 - : D:\DEFENSE SYSTEMS\CBOCLEAN\BOCDRIVE.SYS
23 - [COMODO] : D:\Defense Systems\CBOClean\BOCORE.exe
23 - [COMODO] : C:\Firewall\Comodo\Firewall\cmdagent.exe
23 - [Comodo Research Lab., Inc.] : C:\WINDOWS\System32\DRIVERS\cmdmon.sys
23 - [C-Media Inc] : C:\WINDOWS\System32\drivers\cmaudio.sys
23 - : C:\WINDOWS\System32\DRIVERS\d347bus.sys
23 - : C:\WINDOWS\System32\Drivers\d347prt.sys
23 - [CNet Technology, Inc.] : C:\WINDOWS\System32\DRIVERS\DM9PCI5.SYS
23 - : C:\WINDOWS\System32\drivers\enodpl.sys
23 - [SEIKO EPSON CORPORATION] : C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
23 - [Ahead Software AG and its licensors] : C:\WINDOWS\System32\DRIVERS\imagedrv.sys
23 - [COMODO] : C:\WINDOWS\System32\DRIVERS\inspect.sys
23 - : C:\WINDOWS\runservice.exe
23 - : D:\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
23 - [NVIDIA Corporation] : C:\WINDOWS\System32\nvsvc32.exe
23 - : C:\WINDOWS\System32\DRIVERS\papycpu2.sys
23 - : C:\WINDOWS\System32\DRIVERS\papyjoy.sys
23 - [Creative Technology Ltd.] : C:\WINDOWS\System32\PFMODNT.SYS
23 - [Protection Technology Co.] : C:\WINDOWS\System32\drivers\prodrv04.sys
23 - [Protection Technology] : C:\WINDOWS\System32\drivers\prodrv06.sys
23 - [Protection Technology] : C:\WINDOWS\System32\drivers\prohlp02.sys
23 - [Protection Technology] : C:\WINDOWS\System32\drivers\prosync1.sys
23 - [Protection Technology] : C:\WINDOWS\System32\drivers\sfhlp01.sys
23 - [Windows ® 2000 DDK provider] : C:\Program Files\TGTSOFT\STYLEXP\STYLEXPHELPER.EXE
23 - : C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
23 - : C:\WINDOWS\System32\drivers\tandpl.sys
23 - [Microsoft Corporation] : C:\Program Files\UPHClean\uphclean.exe
23 - [Vimicro Corporation] : C:\WINDOWS\System32\drivers\vmfilter303.sys
23 - [Vimicro Corporation] : C:\WINDOWS\System32\Drivers\usbVM303.sys

System Policies
HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\, HomePage : [Vimicro Corporation] : C:\WINDOWS\System32\Drivers\usbVM303.sys
HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions, NoBrowserOptions : [Vimicro Corporation] : C:\WINDOWS\System32\Drivers\usbVM303.sys


A second spyware scan resulted in removal of some remnants of Screensaver.com and some tracking cookies.

Then I used AVG's free antirootkit tool and found several rootkits… most (or all) of them in the User profile of firefox. Unfortunately, I do not know how to recover the logfiles of AVG antirootkit. :(

It might help so I've also included a recent log of activity from my firewall. I dunno, but my internet seems to have slowed down a lot since i started having problems. The logfile's in the ff link:

http://dpaste.com/hold/18437/

Here's the latest hijackthis log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:32:59 PM, on 9/2/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
D:\Grisoft\AVG7\avgamsvr.exe
D:\Grisoft\AVG7\avgupsvc.exe
D:\Defense Systems\CBOClean\BOCORE.exe
C:\WINDOWS\System32\cisvc.exe
C:\Firewall\Comodo\Firewall\cmdagent.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\runservice.exe
C:\WINDOWS\System32\nvsvc32.exe
D:\Defense Systems\Spyware Terminator\sp_rsser.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Java\j2re1.4.2_11\bin\jusched.exe
C:\WINDOWS\StartupMonitor.exe
D:\Grisoft\AVG7\avgcc.exe
C:\Firewall\Comodo\Firewall\CPF.exe
D:\Defense Systems\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Last.fm\LastFMHelper.exe
C:\WINDOWS\System32\cidaemon.exe
D:\Downloads\WindowsInstaller-KB893803-v2-x86.exe
d:\3b073e03f24f368792d509bc\UPDATE\update.exe
D:\ViRC\ViRC.exe
D:\3dsMax8\3dsmax.exe
C:\DOCUME~1\OBLIVI~1.000\LOCALS~1\Temp\AdskCleanup.0001
C:\DOCUME~1\OBLIVI~1.000\LOCALS~1\Temp\AdskCleanup.0001
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
D:\Mozilla Firefox\firefox.exe
D:\Defense Systems\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\Contagion\FlashGet\jccatch.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O2 - BHO: OsbornTech Popup Blocker - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - D:\Defense Systems\Omniquad Total Security\PopupBlocker\PopupBlocker.dll (file missing)
O2 - BHO: (no name) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - (no file)
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\Contagion\FlashGet\getflash.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_11\bin\jusched.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [AVG7_CC] D:\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Firewall\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [SpywareTerminator] "D:\Defense Systems\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] D:\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] D:\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] D:\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] D:\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: Adobe Gamma Loader.exe.lnk.disabled
O4 - Global Startup: Last.fm Helper.lnk = D:\Last.fm\LastFMHelper.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download All with FlashGet - D:\Contagion\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - D:\Contagion\FlashGet\jc_link.htm
O8 - Extra context menu item: Web Rebates. - file://C:\Program Files\WebRebates4\websrebates\webtrebates\toprC0.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Popup Blocker - {0D555BC6-E331-48b3-A60E-AAC0DF79438A} - D:\Defense Systems\Omniquad Total Security\PopupBlocker\PopupBlocker.dll (file missing)
O9 - Extra 'Tools' menuitem: Popup Blocker - {0D555BC6-E331-48b3-A60E-AAC0DF79438A} - D:\Defense Systems\Omniquad Total Security\PopupBlocker\PopupBlocker.dll (file missing)
O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROProj.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Contagion\FlashGet\FlashGet.exe (file missing)
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Contagion\FlashGet\FlashGet.exe (file missing)
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - D:\Program Files\Free Download Manager\FUM\fumiebtn.dll (file missing)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1187771593874
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1187771555828
O16 - DPF: {CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.4.0_02) -
O16 - DPF: {CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA} (Java Plug-in 1.4.2_11) -
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\Grisoft\AVG7\avgupsvc.exe
O23 - Service: BOCore - COMODO - D:\Defense Systems\CBOClean\BOCORE.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Firewall\Comodo\Firewall\cmdagent.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - D:\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: OPFSVC - Unknown owner - D:\Defense Systems\Omniquad Total Security\OPF\OPFSVC.exe (file missing)
O23 - Service: Personal Firewall - Unknown owner - D:\Defense Systems\Omniquad Total Security\OPF\pfsvc.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - D:\Defense Systems\Spyware Terminator\sp_rsser.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O24 - Desktop Component 0: (no name) - file:///G:/New%20Folder/she%20is%20wanted%20me%20to%20get%20her%20preggy_______%20-%20The%20World%20of%20Filipinas2_files/cutebaby.gif

–
End of file - 9852 bytes


After 5 days, damage has been extensive on my PC. I don't know if I can spare the money for a new hard drive, since a reformat seems to be the only course of action. I'm also a 3d artist and am currently entering a competition with a game development team for the week, so I can't have the PC inactive.

Also, I share the PC with 3 of my siblings… which sucks lol… and unfortunately, I can't monitor their activity constantly.

Anyway, the most pressing problems I've encountered:

1) Popups warning me of corrupt files
2) Loss of 3 Gigabytes of data from drive C of my partitioned 80gig drive… Though, as far as I can tell, all files seem to be intact
3) A boot warning, telling me of an impending S.M.A.R.T failure on my hard drive
4) Damaged msi.dll or something… anyways, it means I can't install some files packaged with Windows Installer
5) Damaged wmploc.dll - I can't anymore open my media player v.10
6) Startup warnings from GoogleToolbarHelper or GoogleToolbarAssistant telling me of a corrupt file
7) Add/Remove Programs list NOTHING. I had to resort to third party uninstallers (Uninstaller and Add/Remove Pro)
8) Stuttering internet connection. It's fast at times then suddenly stutters for apparently no reason
9) Cannot enter safemode

Hmm… I'm sure there are other problems, I just haven't discovered them yet.

Please help :(
Post #3
Hello and welcome to the forums

Please just use the default color. My old eyes have issues :thumbup:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.


(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you, combofix.txt. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick while its running. That may cause it to stall
Post #4
I've done as you said.

However, while using ATF, I encountered a message saying that I couldn't delete a file because it was currently in use… it looked like a registry key (a random string of numbers), but I had firefox and several applications open a the time, so that may have cause it.

Sorry for the colors ;)

Ok, here's the combofix log:


ComboFix 07-08-30.3 - "OBLIVION" 2007-09-03 3:30:39.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.0.1252.1.1033.18.418 [GMT 9:00]


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\microsoft\internet explorer\quick launch\intern~1.lnk
C:\DOCUME~1\OBLIVI~1.000\DESKTOP\internet explorer.lnk
C:\DOCUME~1\OBLIVION\APPLIC~1\microsoft\internet explorer\quick launch\intern~1.lnk
C:\DOCUME~1\OBLIVION\DESKTOP\internet explorer.lnk
C:\WINDOWS\system32\Cfx32.lic
C:\WINDOWS\system32\cfx32.ocx


((((((((((((((((((((((((( Files Created from 2007-08-02 to 2007-09-02 )))))))))))))))))))))))))))))))


2007-09-03 03:21 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-09-02 23:14 113,128 –a—— C:\WINDOWS\system32\drivers\keyscrambler.sys
2007-09-02 18:43 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\vlc
2007-09-02 06:03 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\X-Chat 2
2007-09-02 03:55 138,624 –a—— C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2007-09-02 01:22 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Spyware Terminator
2007-09-02 01:22 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spyware Terminator
2007-09-02 01:15 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\.purple
2007-09-02 01:03 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\IceChat
2007-09-02 00:46 3,968 –a—— C:\WINDOWS\system32\drivers\AvgArCln.sys
2007-09-02 00:10 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-09-01 19:36 235,008 –a—— C:\WINDOWS\UNBOC.EXE
2007-09-01 19:36 208,896 –a—— C:\WINDOWS\CMDLIC.DLL
2007-09-01 19:36 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOC425
2007-09-01 18:56 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Azureus
2007-09-01 18:56 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
2007-09-01 17:55 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-09-01 17:08 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Comodo
2007-09-01 17:07 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Comodo
2007-09-01 16:49 d——– C:\Firewall
2007-09-01 16:29 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\FrostWire
2007-09-01 00:13 39 –a—— C:\WINDOWS\winomnifile.dat
2007-09-01 00:13 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Omniquad
2007-09-01 00:12 d——– C:\WINDOWS\Omniquad Total Security
2007-08-31 16:50 d——– C:\Program Files\Dir2File
2007-08-31 16:05 2,720 –a—— C:\WINDOWS\system32\tmp.reg
2007-08-31 15:01 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\DivX
2007-08-31 06:29 d——– C:\sd
2007-08-31 04:39 61,440 –a—— C:\WINDOWS\ContextMenuExt.dll
2007-08-31 04:39 159,232 –a—— C:\WINDOWS\system32\WindowsUptime.exe
2007-08-31 04:14 d——– C:\i386
2007-08-31 01:17 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\DivX
2007-08-30 23:56 d——– C:\WINDOWS\BDOSCAN8
2007-08-30 20:59 942,832 –a—— C:\Update.exe
2007-08-30 20:59 13 –a—— C:\Patcher.dat
2007-08-27 05:17 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Soldat
2007-08-23 18:51 d——– C:\Program Files\MSECache
2007-08-23 18:50 d——– C:\Program Files\HighMAT CD Writing Wizard
2007-08-23 18:44 d——– C:\WINDOWS\system32\DRM
2007-08-23 18:44 d——– C:\Program Files\UPHClean
2007-08-23 17:58 77,824 –a—— C:\WINDOWS\system32\StartupCPL.exe
2007-08-23 17:58 d——– C:\Program Files\PowerMenu
2007-08-23 17:57 266,360 –a—— C:\WINDOWS\system32\TweakUI.exe
2007-08-23 17:56 d——– C:\Program Files\Microsoft CopyProfile
2007-08-23 17:40 40,960 –a—— C:\WINDOWS\system32\SSUBTMR6.DLL
2007-08-23 17:40 10,752 –a—— C:\WINDOWS\system32\aamd532.dll
2007-08-23 11:38 593,408 –a—— C:\WINDOWS\system32\h323msp.dll
2007-08-23 11:38 550,400 –a—— C:\WINDOWS\system32\rtcdll.dll
2007-08-23 11:38 48,640 –a—— C:\WINDOWS\system32\browser.dll
2007-08-23 11:38 454,656 –a—— C:\WINDOWS\system32\ipnathlp.dll
2007-08-23 11:38 36,864 –a—— C:\WINDOWS\system32\mf3216.dll
2007-08-23 11:02 218,624 –a—— C:\WINDOWS\system32\srrstr.dll
2007-08-23 10:46 d——– C:\Program Files\MSXML 4.0
2007-08-23 10:41 26,112 –a—— C:\WINDOWS\system32\xpsp1hfm.exe
2007-08-23 10:41 d–h—– C:\WINDOWS\$xpsp1hfm$
2007-08-22 17:43 d——– C:\WINDOWS\system32\bits
2007-08-22 17:42 7,680 ——— C:\WINDOWS\system32\bitsprx2.dll
2007-08-22 17:42 7,168 ——— C:\WINDOWS\system32\bitsprx3.dll
2007-08-22 17:42 331,776 –a—— C:\WINDOWS\system32\winhttp.dll
2007-08-22 17:42 17,408 –a—— C:\WINDOWS\system32\qmgrprxy.dll
2007-08-22 17:42 158,720 ——— C:\WINDOWS\system32\xpob2res.dll
2007-08-22 17:38 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2007-08-22 17:37 549,720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-08-22 17:37 43,352 –a—— C:\WINDOWS\system32\wups2.dll
2007-08-22 17:37 33,624 –a—— C:\WINDOWS\system32\wups.dll
2007-08-22 17:37 325,976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-08-20 20:04 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Hamachi
2007-08-20 20:03 25,544 –a—— C:\WINDOWS\system32\drivers\hamachi.sys
2007-08-20 04:24 d——– C:\DOCUME~1\OBLIVI~1.000\dwhelper
2007-08-20 02:44 172,032 –a—— C:\WINDOWS\JAPI2.DLL
2007-08-20 02:44 109,840 –a—— C:\WINDOWS\VidCap32.exe
2007-08-20 02:44 106,496 –a—— C:\WINDOWS\JAPI.DLL
2007-08-20 02:44 102,400 –a—— C:\WINDOWS\MMVEM.EXE
2007-08-20 02:38 73,728 –a—— C:\WINDOWS\VMInstNT.exe
2007-08-20 02:38 32,768 -r——- C:\WINDOWS\Zoom.exe
2007-08-20 02:38 24,576 -r——- C:\WINDOWS\VMPipe.dll
2007-08-20 02:38 d——– C:\WINDOWS\EffectResources
2007-08-13 22:13 d——– C:\Program Files\Codec Pack - All In 1
2007-08-13 22:07 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Thunderbird
2007-08-12 01:52 53,248 -ra—— C:\WINDOWS\system32\InstMed.exe
2007-08-12 01:51 d——– C:\Program Files\Common Files\Logitech
2007-08-11 23:50 182,880 –a—— C:\WINDOWS\system32\iuengine.dll
2007-08-10 15:11 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\gtk-2.0
2007-08-10 15:04 d——– C:\DOCUME~1\OBLIVI~1.000\.gimp-2.3
2007-08-06 20:03 d——– C:\Program Files\Real
2007-08-05 04:54 d——– C:\Program Files\Common Files\Scanner
2007-08-04 06:59 d——– C:\VundoFix Backups
2007-08-03 06:01 d——– C:\WINDOWS\SxsCaPendDel


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-09-03 02:13 107 –ah—– C:\Program Files\Desktop.ini
2007-09-03 01:58 1982848 –a—— C:\WINDOWS\system32\kernel1.exe
2007-09-02 18:49 849 –ahs—- C:\WINDOWS\system32\mmf.sys
2007-09-02 01:15 ——— d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\.purple
2007-08-29 17:49 729088 –a—— C:\WINDOWS\GPInstall.exe
2007-08-13 22:12 737280 –a—— C:\WINDOWS\iun6002.exe
2007-08-02 14:42 ——— d——– C:\Program Files\Chikka
2007-08-01 22:39 0 -ra—— C:\logwmemory.bin
2007-08-01 19:09 ——— d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\LimeWire
2007-08-01 16:50 ——— d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\CoreFTP
2007-08-01 07:04 ——— d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Skype
2007-08-01 06:57 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2007-07-31 20:45 69632 –a—— C:\WINDOWS\system32\wshext.dll
2007-07-31 20:45 413696 –a—— C:\WINDOWS\system32\vbscript.dll
2007-07-31 20:45 36864 –a—— C:\WINDOWS\system32\wshcon.dll
2007-07-31 20:45 32768 –a—— C:\WINDOWS\system32\dispex.dll
2007-07-31 20:45 163840 –a—— C:\WINDOWS\system32\scrobj.dll
2007-07-31 20:45 155648 –a—— C:\WINDOWS\system32\scrrun.dll
2007-07-31 20:45 135168 –a—— C:\WINDOWS\system32\wscript.exe
2007-07-31 20:45 114688 –a—— C:\WINDOWS\system32\cscript.exe
2007-07-31 19:28 ——— d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Talkback
2007-07-31 16:02 ——— d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Yahoo!
2007-07-31 12:59 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-07-31 12:46 ——— d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Uniblue
2007-07-31 12:41 ——— d——– C:\Program Files\Chikka Messenger
2007-07-31 12:12 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
2007-07-31 12:06 ——— d——– C:\Program Files\Yahoo!
2007-07-30 19:19 207736 –a—— C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-27 08:06 524288 –a—— C:\WINDOWS\system32\DivXsm.exe
2007-07-27 08:06 3596288 –a—— C:\WINDOWS\system32\qt-dx331.dll
2007-07-27 08:06 200704 –a—— C:\WINDOWS\system32\ssldivx.dll
2007-07-27 08:06 144704 –a—— C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-07-27 08:06 1044480 –a—— C:\WINDOWS\system32\libdivx.dll
2007-07-27 08:03 823296 –a—— C:\WINDOWS\system32\divx_xx0c.dll
2007-07-27 08:03 823296 –a—— C:\WINDOWS\system32\divx_xx07.dll
2007-07-27 08:03 81920 –a—— C:\WINDOWS\system32\dpl100.dll
2007-07-27 08:03 802816 –a—— C:\WINDOWS\system32\divx_xx11.dll
2007-07-27 08:03 740442 –a—— C:\WINDOWS\system32\DivX.dll
2007-07-27 08:03 12288 –a—— C:\WINDOWS\system32\DivXWMPExtType.dll
2007-07-20 00:57 267112 –a—— C:\WINDOWS\system32\xactengine2_9.dll
2007-07-20 00:54 18280 –a—— C:\WINDOWS\system32\x3daudio1_2.dll
2007-07-19 18:14 444776 –a—— C:\WINDOWS\system32\d3dx10_35.dll
2007-07-19 18:14 3727720 –a—— C:\WINDOWS\system32\d3dx9_35.dll
2007-07-19 18:14 1358192 –a—— C:\WINDOWS\system32\D3DCompiler_35.dll
2007-07-09 15:47 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Autodesk
2007-07-09 02:34 ——— d——– C:\Program Files\Autodesk
2007-07-06 00:44 ——— d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Symantec
2007-06-20 20:46 266088 –a—— C:\WINDOWS\system32\xactengine2_8.dll
2005-01-10 16:50 39936 –ahs—- C:\Program Files\Thumbs.db
2004-05-28 16:15:14 0 –sh–r C:\WINDOWS\nSdanamlG.sys
2005-09-08 04:52:48 200 –sh–r C:\WINDOWS\system32\GlmanadSn.sys


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-10-22 12:22]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]
"C-Media Mixer"="Mixer.exe" [2002-06-12 16:23 C:\WINDOWS\mixer.exe]
"LVCOMSX"="C:\WINDOWS\System32\LVCOMSX.EXE" [2004-10-08 11:52]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_11\bin\jusched.exe" [2006-02-13 11:53]
"Adobe Reader Speed Launcher"="D:\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2006-10-22 12:22]
"Run StartupMonitor"="StartupMonitor.exe" [2000-05-20 17:23 C:\WINDOWS\StartupMonitor.exe]
"AVG7_CC"="D:\Grisoft\AVG7\avgcc.exe" [2007-08-29 21:39]
"COMODO Firewall Pro"="C:\Firewall\Comodo\Firewall\CPF.exe" [2007-09-01 16:50]
"SpywareTerminator"="D:\Defense Systems\Spyware Terminator\SpywareTerminatorShield.exe" [2007-09-02 01:22]
"BigDog303"="C:\WINDOWS\VM303_STI.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-01-31 01:24]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-01 12:47]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=0 (0x0)
"DisableRegedit"=0 (0x0)
"NoVisualStyleChoice"=0 (0x0)
"NoColorChoice"=0 (0x0)
"NoSizeChoice"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"=1 (0x1)
"NoSharedDocuments"=1 (0x1)
"ForceClassicControlPanel"=1 (0x1)
"NoSMConfigurePrograms"=1 (0x1)
"NoChangeKeyboardNavigationIndicators"=0 (0x0)
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bron-Spizaetus]
"C:\WINDOWS\ShellNew\ElnorB.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"STYLEXP"=C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
"YSearchProtection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"DM_Server"=C:\PROGRA~1\COMETS~1\DM\bin\dmserver.exe /onreboot
"NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe
"REGSHAVE"=C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"UStorag"=d:\program files\u-storage tool2.9\ustorage.exe sys_auto_run d:\Program Files\U-Storage Tool2.9

R1 papycpu2;papycpu2;C:\WINDOWS\System32\DRIVERS\papycpu2.sys
R1 papyjoy;papyjoy;C:\WINDOWS\System32\DRIVERS\papyjoy.sys
R1 prodrv04;Star Force copy protection driver v4;C:\WINDOWS\System32\drivers\prodrv04.sys
R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
R2 LicCtrlService;LicCtrl Service;C:\WINDOWS\runservice.exe
R2 WBHWDOCT;WBHWDOCT;C:\WINDOWS\System32\drivers\WBHWDOCT.sys
R3 BOCDRIVE;BOClean Kernel Monitor.;\??\D:\Defense Systems\CBOClean\BOCDRIVE.sys
R3 vmfilter303;vmfilter303;C:\WINDOWS\System32\drivers\vmfilter303.sys
R3 ZSMC303;A4 TECH PC Camera H;C:\WINDOWS\System32\Drivers\usbVM303.sys
S2 OPFSVC;OPFSVC;D:\Defense Systems\Omniquad Total Security\OPF\OPFSVC.exe
S2 Personal Firewall;Personal Firewall;D:\Defense Systems\Omniquad Total Security\OPF\pfsvc.exe
S3 bDMusicb;bDMusicb;\??\C:\DOCUME~1\OBLIVI~1.000\LOCALS~1\Temp\bDMusicb.sys
S3 C-Dilla;C-Dilla;\??\C:\WINDOWS\System32\drivers\CDANT.SYS
S3 KeyScrambler;KeyScrambler;C:\WINDOWS\System32\drivers\keyscrambler.sys
S3 MR97310_VGA_DUAL_CAMERA;MR97310 VGA Dual Mode Camera;C:\WINDOWS\System32\DRIVERS\mr97310v.sys
S3 USTOR;U-Storage Controller;C:\WINDOWS\System32\DRIVERS\UStork.sys

*Newly Created Service* - CATCHME

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-03 03:35:24
Windows 5.1.2600 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-09-03 3:36:31
C:\ComboFix-quarantined-files.txt … 2007-09-03 03:36

— E O F —
Post #5
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\ShellNew\ElnorB.exe

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=-
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=-
"DisableRegedit"=-
"NoVisualStyleChoice"=-
"NoColorChoice"=-
"NoSizeChoice"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bron-Spizaetus]


Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log
Post #6 last edited
okay. thanks :) EDIT: also, please explicitly state if I have to close windows or applications; or reboot. as I am also currently working, but I will definitely put more priority into fixing my machine first. :)
Post #7

okay. thanks :)

EDIT:
also, please explicitly state if I have to close windows or applications; or reboot. as I am also currently working, but I will definitely put more priority into fixing my machine first. :)

Just run the fix and post the log it generates.
Post #8
Some warnings that popped up while combofix was running:

1)The contents of folder C:\Windows\erdnt\subs could not be completely deleted
2)The file or directory \WINDOWS\$NtUninstallKB885626$ is corrupt and unreadable. Please run the ChkDsk utility.


The Log:

ComboFix 07-08-30.3 - "OBLIVION" 2007-09-03 4:37:12.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.0.1252.1.1033.18.397 [GMT 9:00]

FILE::
C:\WINDOWS\ShellNew\ElnorB.exe


((((((((((((((((((((((((( Files Created from 2007-08-02 to 2007-09-02 )))))))))))))))))))))))))))))))


2007-09-03 03:21 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-09-02 23:14 113,128 –a—— C:\WINDOWS\system32\drivers\keyscrambler.sys
2007-09-02 18:43 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\vlc
2007-09-02 06:03 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\X-Chat 2
2007-09-02 03:55 138,624 –a—— C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2007-09-02 01:22 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Spyware Terminator
2007-09-02 01:22 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spyware Terminator
2007-09-02 01:15 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\.purple
2007-09-02 01:03 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\IceChat
2007-09-02 00:46 3,968 –a—— C:\WINDOWS\system32\drivers\AvgArCln.sys
2007-09-02 00:10 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-09-01 19:36 235,008 –a—— C:\WINDOWS\UNBOC.EXE
2007-09-01 19:36 208,896 –a—— C:\WINDOWS\CMDLIC.DLL
2007-09-01 19:36 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOC425
2007-09-01 18:56 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Azureus
2007-09-01 18:56 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
2007-09-01 17:55 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-09-01 17:08 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Comodo
2007-09-01 17:07 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Comodo
2007-09-01 16:49 d——– C:\Firewall
2007-09-01 16:29 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\FrostWire
2007-09-01 00:13 39 –a—— C:\WINDOWS\winomnifile.dat
2007-09-01 00:13 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Omniquad
2007-09-01 00:12 d——– C:\WINDOWS\Omniquad Total Security
2007-08-31 16:50 d——– C:\Program Files\Dir2File
2007-08-31 16:05 2,720 –a—— C:\WINDOWS\system32\tmp.reg
2007-08-31 15:01 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\DivX
2007-08-31 06:29 d——– C:\sd
2007-08-31 04:39 61,440 –a—— C:\WINDOWS\ContextMenuExt.dll
2007-08-31 04:39 159,232 –a—— C:\WINDOWS\system32\WindowsUptime.exe
2007-08-31 04:14 d——– C:\i386
2007-08-31 01:17 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\DivX
2007-08-30 23:56 d——– C:\WINDOWS\BDOSCAN8
2007-08-30 20:59 942,832 –a—— C:\Update.exe
2007-08-30 20:59 13 –a—— C:\Patcher.dat
2007-08-27 05:17 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Soldat
2007-08-23 18:51 d——– C:\Program Files\MSECache
2007-08-23 18:50 d——– C:\Program Files\HighMAT CD Writing Wizard
2007-08-23 18:44 d——– C:\WINDOWS\system32\DRM
2007-08-23 18:44 d——– C:\Program Files\UPHClean
2007-08-23 17:58 77,824 –a—— C:\WINDOWS\system32\StartupCPL.exe
2007-08-23 17:58 d——– C:\Program Files\PowerMenu
2007-08-23 17:57 266,360 –a—— C:\WINDOWS\system32\TweakUI.exe
2007-08-23 17:56 d——– C:\Program Files\Microsoft CopyProfile
2007-08-23 17:40 40,960 –a—— C:\WINDOWS\system32\SSUBTMR6.DLL
2007-08-23 17:40 10,752 –a—— C:\WINDOWS\system32\aamd532.dll
2007-08-23 11:38 593,408 –a—— C:\WINDOWS\system32\h323msp.dll
2007-08-23 11:38 550,400 –a—— C:\WINDOWS\system32\rtcdll.dll
2007-08-23 11:38 48,640 –a—— C:\WINDOWS\system32\browser.dll
2007-08-23 11:38 454,656 –a—— C:\WINDOWS\system32\ipnathlp.dll
2007-08-23 11:38 36,864 –a—— C:\WINDOWS\system32\mf3216.dll
2007-08-23 11:02 218,624 –a—— C:\WINDOWS\system32\srrstr.dll
2007-08-23 10:46 d——– C:\Program Files\MSXML 4.0
2007-08-23 10:41 26,112 –a—— C:\WINDOWS\system32\xpsp1hfm.exe
2007-08-23 10:41 d–h—– C:\WINDOWS\$xpsp1hfm$
2007-08-22 17:43 d——– C:\WINDOWS\system32\bits
2007-08-22 17:42 7,680 ——— C:\WINDOWS\system32\bitsprx2.dll
2007-08-22 17:42 7,168 ——— C:\WINDOWS\system32\bitsprx3.dll
2007-08-22 17:42 331,776 –a—— C:\WINDOWS\system32\winhttp.dll
2007-08-22 17:42 17,408 –a—— C:\WINDOWS\system32\qmgrprxy.dll
2007-08-22 17:42 158,720 ——— C:\WINDOWS\system32\xpob2res.dll
2007-08-22 17:38 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2007-08-22 17:37 549,720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-08-22 17:37 43,352 –a—— C:\WINDOWS\system32\wups2.dll
2007-08-22 17:37 33,624 –a—— C:\WINDOWS\system32\wups.dll
2007-08-22 17:37 325,976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-08-20 20:04 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Hamachi
2007-08-20 20:03 25,544 –a—— C:\WINDOWS\system32\drivers\hamachi.sys
2007-08-20 04:24 d——– C:\DOCUME~1\OBLIVI~1.000\dwhelper
2007-08-20 02:44 172,032 –a—— C:\WINDOWS\JAPI2.DLL
2007-08-20 02:44 109,840 –a—— C:\WINDOWS\VidCap32.exe
2007-08-20 02:44 106,496 –a—— C:\WINDOWS\JAPI.DLL
2007-08-20 02:44 102,400 –a—— C:\WINDOWS\MMVEM.EXE
2007-08-20 02:38 73,728 –a—— C:\WINDOWS\VMInstNT.exe
2007-08-20 02:38 32,768 -r——- C:\WINDOWS\Zoom.exe
2007-08-20 02:38 24,576 -r——- C:\WINDOWS\VMPipe.dll
2007-08-20 02:38 d——– C:\WINDOWS\EffectResources
2007-08-13 22:13 d——– C:\Program Files\Codec Pack - All In 1
2007-08-13 22:07 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Thunderbird
2007-08-12 01:52 53,248 -ra—— C:\WINDOWS\system32\InstMed.exe
2007-08-12 01:51 d——– C:\Program Files\Common Files\Logitech
2007-08-11 23:50 182,880 –a—— C:\WINDOWS\system32\iuengine.dll
2007-08-10 15:11 d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\gtk-2.0
2007-08-10 15:04 d——– C:\DOCUME~1\OBLIVI~1.000\.gimp-2.3
2007-08-06 20:03 d——– C:\Program Files\Real
2007-08-05 04:54 d——– C:\Program Files\Common Files\Scanner
2007-08-04 06:59 d——– C:\VundoFix Backups
2007-08-03 06:01 d——– C:\WINDOWS\SxsCaPendDel


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-09-03 02:13 107 –ah—– C:\Program Files\Desktop.ini
2007-09-03 01:58 1982848 –a—— C:\WINDOWS\system32\kernel1.exe
2007-09-02 18:49 849 –ahs—- C:\WINDOWS\system32\mmf.sys
2007-09-02 01:15 ——— d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\.purple
2007-08-29 17:49 729088 –a—— C:\WINDOWS\GPInstall.exe
2007-08-13 22:12 737280 –a—— C:\WINDOWS\iun6002.exe
2007-08-02 14:42 ——— d——– C:\Program Files\Chikka
2007-08-01 22:39 0 -ra—— C:\logwmemory.bin
2007-08-01 19:09 ——— d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\LimeWire
2007-08-01 16:50 ——— d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\CoreFTP
2007-08-01 07:04 ——— d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Skype
2007-08-01 06:57 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2007-07-31 20:45 69632 –a—— C:\WINDOWS\system32\wshext.dll
2007-07-31 20:45 413696 –a—— C:\WINDOWS\system32\vbscript.dll
2007-07-31 20:45 36864 –a—— C:\WINDOWS\system32\wshcon.dll
2007-07-31 20:45 32768 –a—— C:\WINDOWS\system32\dispex.dll
2007-07-31 20:45 163840 –a—— C:\WINDOWS\system32\scrobj.dll
2007-07-31 20:45 155648 –a—— C:\WINDOWS\system32\scrrun.dll
2007-07-31 20:45 135168 –a—— C:\WINDOWS\system32\wscript.exe
2007-07-31 20:45 114688 –a—— C:\WINDOWS\system32\cscript.exe
2007-07-31 19:28 ——— d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Talkback
2007-07-31 16:02 ——— d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Yahoo!
2007-07-31 12:59 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-07-31 12:46 ——— d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Uniblue
2007-07-31 12:41 ——— d——– C:\Program Files\Chikka Messenger
2007-07-31 12:12 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
2007-07-31 12:06 ——— d——– C:\Program Files\Yahoo!
2007-07-30 19:19 207736 –a—— C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-27 08:06 524288 –a—— C:\WINDOWS\system32\DivXsm.exe
2007-07-27 08:06 3596288 –a—— C:\WINDOWS\system32\qt-dx331.dll
2007-07-27 08:06 200704 –a—— C:\WINDOWS\system32\ssldivx.dll
2007-07-27 08:06 144704 –a—— C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-07-27 08:06 1044480 –a—— C:\WINDOWS\system32\libdivx.dll
2007-07-27 08:03 823296 –a—— C:\WINDOWS\system32\divx_xx0c.dll
2007-07-27 08:03 823296 –a—— C:\WINDOWS\system32\divx_xx07.dll
2007-07-27 08:03 81920 –a—— C:\WINDOWS\system32\dpl100.dll
2007-07-27 08:03 802816 –a—— C:\WINDOWS\system32\divx_xx11.dll
2007-07-27 08:03 740442 –a—— C:\WINDOWS\system32\DivX.dll
2007-07-27 08:03 12288 –a—— C:\WINDOWS\system32\DivXWMPExtType.dll
2007-07-20 00:57 267112 –a—— C:\WINDOWS\system32\xactengine2_9.dll
2007-07-20 00:54 18280 –a—— C:\WINDOWS\system32\x3daudio1_2.dll
2007-07-19 18:14 444776 –a—— C:\WINDOWS\system32\d3dx10_35.dll
2007-07-19 18:14 3727720 –a—— C:\WINDOWS\system32\d3dx9_35.dll
2007-07-19 18:14 1358192 –a—— C:\WINDOWS\system32\D3DCompiler_35.dll
2007-07-09 15:47 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Autodesk
2007-07-09 02:34 ——— d——– C:\Program Files\Autodesk
2007-07-06 00:44 ——— d——– C:\DOCUME~1\OBLIVI~1.000\APPLIC~1\Symantec
2007-06-20 20:46 266088 –a—— C:\WINDOWS\system32\xactengine2_8.dll
2005-01-10 16:50 39936 –ahs—- C:\Program Files\Thumbs.db
2004-05-28 16:15:14 0 –sh–r C:\WINDOWS\nSdanamlG.sys
2005-09-08 04:52:48 200 –sh–r C:\WINDOWS\system32\GlmanadSn.sys


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-10-22 12:22]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]
"C-Media Mixer"="Mixer.exe" [2002-06-12 16:23 C:\WINDOWS\mixer.exe]
"LVCOMSX"="C:\WINDOWS\System32\LVCOMSX.EXE" [2004-10-08 11:52]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_11\bin\jusched.exe" [2006-02-13 11:53]
"Adobe Reader Speed Launcher"="D:\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2006-10-22 12:22]
"Run StartupMonitor"="StartupMonitor.exe" [2000-05-20 17:23 C:\WINDOWS\StartupMonitor.exe]
"AVG7_CC"="D:\Grisoft\AVG7\avgcc.exe" [2007-08-29 21:39]
"COMODO Firewall Pro"="C:\Firewall\Comodo\Firewall\CPF.exe" [2007-09-01 16:50]
"SpywareTerminator"="D:\Defense Systems\Spyware Terminator\SpywareTerminatorShield.exe" [2007-09-02 01:22]
"BigDog303"="C:\WINDOWS\VM303_STI.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-01-31 01:24]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-01 12:47]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"=1 (0x1)
"NoSharedDocuments"=1 (0x1)
"ForceClassicControlPanel"=1 (0x1)
"NoSMConfigurePrograms"=1 (0x1)
"NoChangeKeyboardNavigationIndicators"=0 (0x0)
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bron-Spizaetus]
"C:\WINDOWS\ShellNew\ElnorB.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"STYLEXP"=C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
"YSearchProtection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"DM_Server"=C:\PROGRA~1\COMETS~1\DM\bin\dmserver.exe /onreboot
"NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe
"REGSHAVE"=C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"UStorag"=d:\program files\u-storage tool2.9\ustorage.exe sys_auto_run d:\Program Files\U-Storage Tool2.9

R1 papycpu2;papycpu2;C:\WINDOWS\System32\DRIVERS\papycpu2.sys
R1 papyjoy;papyjoy;C:\WINDOWS\System32\DRIVERS\papyjoy.sys
R1 prodrv04;Star Force copy protection driver v4;C:\WINDOWS\System32\drivers\prodrv04.sys
R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
R2 LicCtrlService;LicCtrl Service;C:\WINDOWS\runservice.exe
R2 WBHWDOCT;WBHWDOCT;C:\WINDOWS\System32\drivers\WBHWDOCT.sys
R3 BOCDRIVE;BOClean Kernel Monitor.;\??\D:\Defense Systems\CBOClean\BOCDRIVE.sys
R3 vmfilter303;vmfilter303;C:\WINDOWS\System32\drivers\vmfilter303.sys
R3 ZSMC303;A4 TECH PC Camera H;C:\WINDOWS\System32\Drivers\usbVM303.sys
S2 OPFSVC;OPFSVC;D:\Defense Systems\Omniquad Total Security\OPF\OPFSVC.exe
S2 Personal Firewall;Personal Firewall;D:\Defense Systems\Omniquad Total Security\OPF\pfsvc.exe
S3 bDMusicb;bDMusicb;\??\C:\DOCUME~1\OBLIVI~1.000\LOCALS~1\Temp\bDMusicb.sys
S3 C-Dilla;C-Dilla;\??\C:\WINDOWS\System32\drivers\CDANT.SYS
S3 KeyScrambler;KeyScrambler;C:\WINDOWS\System32\drivers\keyscrambler.sys
S3 MR97310_VGA_DUAL_CAMERA;MR97310 VGA Dual Mode Camera;C:\WINDOWS\System32\DRIVERS\mr97310v.sys
S3 USTOR;U-Storage Controller;C:\WINDOWS\System32\DRIVERS\UStork.sys

*Newly Created Service* - CATCHME

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-03 04:51:53
Windows 5.1.2600 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-09-03 4:54:12
C:\ComboFix2.txt … 2007-09-03 03:36
C:\ComboFix-quarantined-files.txt … 2007-09-03 04:54

— E O F —
Post #9
Manual steps to run Chkdsk at the command prompt 1. Click Start, and then Run. 2. In Open, type cmd, and then press ENTER. 3. Use one of the following procedures: • To run Chkdsk in read-only mode, at the command prompt, type chkdsk, and then press ENTER. • To repair errors without scanning the volume for bad sectors, at the command prompt, type chkdsk volume:/f, and then press ENTER. Note If one or more of the files on the hard disk are open, you will receive the following message: Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts? (Y/N) Type Y, and then press ENTER to schedule the disk check, and then restart your computer to start the disk check. • To repair errors, locate bad sectors, and recover readable information, at the command prompt, type chkdsk volume:/r, and then press ENTER. Note If one or more of the files on the hard disk are open, you will receive the following message: Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts? (Y/N) Type Y, and then press ENTER to schedule the disk check, and then restart your computer to start the disk check.
Post #10
I have run chkdsk c:/f, restarted the pc, and allowed it to scan. I hesitate to use chkdsk c:/r since i already know that my hard disk has bad sectors (if the warning of a S.M.A.R.T. failure is any indication), and in previous experience, full checkdisks would take about half a day of scanning ;) Everything seems faster now :D However, I still have missing files. The most important of which is the lost Windows Installer. I may also mention that I have Autopatcher and have previously updated to the new Windows Installer packaged along with other XP updates in Autopatcher. Is Autopatcher trustworthy? Or was it the cause of the loss of msi? Anyhow, aside from msi's absence, Add/Remove programs still does not list anything. Is there a way of restoring these functions (and possibly others disabled of which I'm unaware of) without resorting to inserting the installer disk? My XP is pirated (as is most of the OS out here in the Philippines), we simply do not have the money to spend on software :( I do not like piracy, but we really have no choice; hence why I resort to GPL programs if possible. Anyway, Thanks! :) My PC feels better, is there anything else I have to do?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI